Avoid slow cache restore and scope Worker preview token

.gitea/workflows/deploy.yml

@@ -27,7 +27,6 @@ jobs:
         uses: https://github.com/actions/setup-node@v4
         with:
           node-version: 22
-          cache: npm
       - name: Install locked dependencies
         run: npm ci
       - name: Validate and build selected site
@@ -37,5 +36,5 @@ jobs:
       - name: Deploy non-production Worker
         run: npx wrangler deploy --config "wrangler/${SITE_KEY}.jsonc"
         env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_WORKER_PREVIEW_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}

README.md

@@ -35,7 +35,9 @@ routes, account IDs, or secrets.
 
 The Gitea workflow deploys only a non-production Worker from the pilot branch:
 `3031023-xyz-www-preview` by default, or the manually selected `blog` site.
-It uses the existing repository secrets `CF_API_TOKEN` and `CF_ACCOUNT_ID`.
+It uses `CF_WORKER_PREVIEW_TOKEN` and `CF_ACCOUNT_ID`. The preview token is a
+separate, account-scoped Workers deployment credential; it does not replace
+the Pages token retained on `main` for rollback.
 Routine jobs do not configure DNS or custom domains.
 
 Production hostname attachment and the `www` redirect are manual,

docs/preview-deployment.md

@@ -10,7 +10,11 @@ separate Worker names:
 
 `workers.dev` is the only preview destination. Neither Wrangler configuration
 contains a route, custom domain, zone ID, account ID, or token. Cloudflare
-credentials remain Gitea repository secrets.
+credentials remain Gitea repository secrets. The preview workflow uses
+`CF_WORKER_PREVIEW_TOKEN`, scoped only to the Cloudflare account hosting this
+pilot. Grant it the Cloudflare **Edit Cloudflare Workers** template (including
+Account Workers Scripts edit/write) and retain `CF_ACCOUNT_ID` as the account
+selector. Do not grant DNS edit permissions for routine preview deployment.
 
 The primary Worker must pass its public preview test matrix before an operator
 records the exact Pages deployment/DNS state and requests production-cutover